3

I'm working on a website that integrates the Facebook login API. When a user clicks the logout button for the website, I log them out of the website's session. The question is if I should be calling the Facebook logout method to log the user out of their Facebook session as well.

Based on the "Keep me logged in" checkbox on the Facebook login dialog, I would assume that we should be logging them out of Facebook too.

I've seen on sites like Quora, Groupon and Vimeo that if a user logs in with Facebook to the site and then logs out, their Facebook session is still valid.

Improve this question
3
  • I don't think it is possible for your site to log me out of Facebook.
    – DaveAlger
    Commented Feb 9, 2015 at 18:51
  • In point of fact, logging out of Facebook doesn't always completely log you out of Facebook.
    – aslum
    Commented Feb 9, 2015 at 19:18
  • If the FaceBook API actually allows then then make it a conscious option for them to check a box which says "Log me out of FaceBook as well". Just make sure to have this checked by default and wait for the wave of complaints. It's will be the most decisive A/B testing in history.
    – MonkeyZeus
    Commented Feb 9, 2015 at 20:07

2 Answers 2

Reset to default
3

I seriously doubt that also logging out of Facebook is the expected behavior in the most common scenarios. However, there is a worst-case scenario where logging them out might be the civilized thing to do on their behalf.

The most nuanced approach would be to leave them in whatever state they were in when they came to your site: so if they were signed in to FB already you leave them signed in when they leave. If they had to authenticate to Facebook, you sign them out when they're done, respecting the value of the "Keep me signed in" checkbox.

Scenario 1 (most common): The user comes to your site. They're using their computer or device. (you have no way to know this.) They're already signed in to Facebook. They use your site and leave. In this case it would be really annoying to sign them out of Facebook.

Scenario 2 (worst-case): The user comes to your site. They're using a computer at a hotel business center or in a webcafe. They have to sign in to Facebook to sign in to your site. They use your site. They forget that Facebook was involved at all. (Count on this.) They leave your site. In this case it would be very nice to sign them out of Facebook.

Scenario 3 (common with an annoying downside): They're on a mobile browser. Don't sign them out of Facebook. Signing in on mobile is very tedious and even more error-prone than on a computer with a proper keyboard. Mobile devices are very personal and it's likely they want to remain signed in on Facebook.

Improve this answer
9
  • 2
    Serious doubt is a kind way of saying "that's crazy"! If they log in on a public computer, it's up to them to also log out of that computer when they're done. As this is not the primary use case for almost any application, logging out would be a terrible solution.
    – plainclothes
    Commented Feb 9, 2015 at 18:44
  • The fact of the matter is people forget to log out of public computers all the time. FB makes it possible to know whether someone is signed in when they begin oAuth, so leverage this. Good UX typically requires a bit of nuance.
    – ElBel
    Commented Feb 9, 2015 at 18:47
  • 2
    Good point about 'oAuth' status. I still think it's a terrible UX to log someone out of another site ... nuance is a pain!
    – plainclothes
    Commented Feb 9, 2015 at 18:50
  • It does take more time. :) If you didn't have time for nuance I'd keep them logged in to support the most common use case, i.e. someone being logged in on their own device.
    – ElBel
    Commented Feb 9, 2015 at 18:51
  • 1
    Guessing is part of the UX game. You can quote all the stats you like, but there is always an element of interpretation (unless you're dealing with an audience of one ... maybe). "Experience" is a fuzzy subject. You just get better at it over time.
    – plainclothes
    Commented Feb 9, 2015 at 20:36
0

I've seen on sites like Quora, Groupon and Vimeo that if a user logs in with Facebook to the site and then logs out, their Facebook session is still valid.

As it should be.

You've logged into "SiteA" and you then logged out of "SiteA". You never visited Facebook during this time, perhaps not even during the particular browser session, so the user is not in the frame of mind that Facebook has anything to do with visiting "SiteA".

When I log into the site I may have Facebook on the mind, as I click the appropriate icon, but I don't click the "Log out using Facebook" button. The "log out" button is the same no matter how I logged in (or it should be), so going off and doing something the user didn't ask to do (i.e., log out of Facebook) is not appropriate.

Let's say you do log of Facebook too. Does that mean you log the user out of every website that uses Facebook to authenticate? I certainly hope not! If that were even possible, it would be a sure fire way to get users mad at you very quickly!

If I have a key that unlocks both my front and back door -- when I unlock my back door, should I expect my front door to be unlocked too? No. I'm dealing with my back door, as I am dealing with "SiteA". Leave the pieces that do not have anything to do with my current action out of it!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.